PT-2026-37128 · Nhost · Nhost

Skoveit

·

Published

2026-04-18

·

Updated

2026-05-08

·

CVE-2026-41574

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Nhost versions prior to 0.49.1
Description Nhost automatically links incoming OAuth identities to existing accounts when email addresses match, provided the email is marked as verified. Several provider adapters fail to correctly populate the profile.EmailVerified boolean, leading to potential account takeover. Specifically, the Discord adapter ignores the verified field from the API, and the Bitbucket adapter falls back to using unconfirmed emails while marking them as verified. Additionally, the AzureAD and EntraID adapters derive emails from non-ownership-proving fields, such as the user principal name, and mark them as verified regardless of actual ownership. This allows an attacker to use an email they do not own to merge their OAuth identity into a victim's account and obtain a full authenticated session.
Technical details include the following:
  • Vulnerable Function: providerFlowSignIn() in services/auth/go/controller/sign in id token.go links identities without a verification guard.
  • Vulnerable Variables: The profile.EmailVerified boolean is incorrectly trusted or populated.
Recommendations Update to version 0.49.1. As a temporary workaround, restrict the use of Discord, Bitbucket, AzureAD, and EntraID as OAuth providers until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-41574
GHSA-6G38-8J4P-J3PR

Affected Products

Nhost